en
Severity across 4 analyzed records
A short verification protects source data and prevents automated AI requests.
The GCVE catalog currently lists 4 vulnerability records affecting ray.
Among the 4 records analyzed by CyStack, 3 are High or Critical and 1 appear in the CISA KEV catalog.
Compare the version you run with each vulnerability and the provider guidance below. The data only includes records analyzed so far.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-41486Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization | Exploitation statusNot known exploited | FixYes | Published05/08/2026 | SeverityHigh |
CVE-2026-32981Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure | Exploitation statusPublic exploit | FixYes | Published03/17/2026 | SeverityHigh |
CVE-2026-27482Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) | Exploitation statusPublic exploit | FixNot confirmed | Published02/21/2026 | SeverityMedium |
CVE-2025-62593Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack | Exploitation statusKEV | FixYes | Published11/26/2025 | SeverityCritical |
